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CLAIMS 
We claim: 

1 . A method for managing changes in a computer system comprising the steps of: 

selecting processes on the computer system in accordance with input specifications, 
detecting changes made by the selected processes to data items, and 
storing the detected changes as records in a database. 

2. The method of claim 1 further comprising the step of limiting the detection of 
changes to only data items matching specified criteria. 

3. The method of claim 1 further comprising the step of selecting change records from 
the database pursuant to specified criteria. 

4. The method of claim 3 further comprising the step of producing the selected 
change records in a specified output format. 

5. The method of claim 3 further comprising the steps of: 

determining the reverse of the changes stored in the selected change records, 
and 

applying the reverse of the selected change records to the data items referred to 
by the selected change records in order to return the data items to their state 
prior to the occurrence of the changes stored in the selected change records. 

6. The method of claim 3 further comprising the step of applying the changes stored 
in the selected change records to similar data items on a different computer system 
to cause the same changes on the different computer system. 

7. The method of claim 1 further comprising the step of storing the reverse of the 
detected changes as change records in the database. 

8. The method of claim 7 further comprising the steps of: 

selecting change records from the database pursuant to specified criteria, 
applying the reverse of the selected change records to the data items referred 
to by the selected change records in order to return the data items to their 
state prior to the occurrence of the changes stored in the selected change 
records. 
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9. The method of claim 1 further comprising the steps of: 

condensing sequences of change records to eliminate intermediate changes, and 
storing the condensed sequences in the database. 

1 0. The method of claim 1 further comprising the step of adding a user-specified field to 
a change record in the database. 

1 1 . The method of claim 1 further comprising the step of terminating the detection of 
changes upon the occurrence of any of (i) user request, (ii) the satisfaction of conditions 
specified by the user, or (iii) termination of all selected processes. 

1 2. The method of claim 1 , further comprising the step of detecting links from a data 
item to other data items. 

1 3. The method of claim 1 , further comprising the step of detecting changes made by 
one or more of the selected processes to a first data item resulting from changes to a 
second data item linked to the first data item. 

1 4. The method of claim 1 further comprising the step of alerting a user when changes 
matching specified criteria are detected. 

1 5. The method of claim 1 further comprising the step of transmitting information about 
the detected changes to a specified destination. 

1 6. The method of claim 1 further comprising the steps of: 

detecting changes to data items on a remote computer system by selected 
processes on the computer system prior to storing the changes as change 
records in the database, 

recording the identity of the remote computer system in the database, and 
associating the identity of the remote computer system with the change in the 
stored change record. 

1 7. The method of claim 1 further comprising the step of detecting communication 
attempts by the selected processes. 

1 8. The method of claim 1 7 further comprising the steps of: 

determining any processes that are the destination of the communication 
attempts, 

detecting changes made by the destination processes to data items, and 
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storing the detected changes as change records in the database. 

1 9. The method of claim 1 7 further comprising the steps of: 

detecting that the communication attempts are to processes on a remote 
computer system, 

determining any processes on the remote computer system that are the 
destination of the communication attempts, 

detecting changes made by the destination processes to data items, and 
storing the detected changes as change records in the database. 

20. The method of claim 1 further comprising the steps of: 

recording selected processes or detected changes in a session history, and 
storing the session history as a session record in the database. 

21 . The method of claim 20 further comprising the steps of: 

searching the database for any session records matching specified criteria, 
selecting change records referred to by the matching session records, and 
producing the selected change records in a specified output format. 

22. The method of claim 20 further comprising the steps of: 

condensing sequences of change records in the session history to eliminate 
intermediate changes, and 

storing the condensed session history as a session record in the database. 

23. The method of claim 20 further comprising the step of adding a user-specified 
field to the session record. 

24. The method of claim 20 further comprising the step of adding additional 
processes to an existing session history. 

25. The method of claim 20 further comprising the step of terminating the session 
history upon the occurrence of any of (i) user request, (ii) the satisfaction of 
conditions specified by the user, or (iii) termination of all selected processes. 

26. The method of claim 20 further comprising the step of alerting a user when a 
session history matching specified criteria is detected. 

27. The method of claim 20 further comprising the step of transmitting information 
about the session history to a specified destination. 
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28. The method of claim 20 further comprising the steps of: 

detecting changes within the session history to data items on a remote 
computer system, 

recording the identity of the remote computer system in the database, and 
associating the session history with the identity of the remote computer 
system in the database. 

29. The method of claim 20 further comprising the step of detecting communication 
attempts by the selected processes*. 

30. The method of claim 29 further comprising the steps of 

determining any processes that are the destination of the communication 
attempts, 

detecting changes made by the destination processes to data items, 
recording the detected changes in a session history, and 
storing the session history as a session record in the database. 

31 . The method of claim 29 further comprising the steps of 

detecting that the communication attempts are to processes on a remote 
computer system, 

determining any processes on the remote computer system that are the 
destination of the communication attempts, 

detecting changes made by the destination processes to data items, 
recording the detected changes in a session history, and 
storing the session history as a session record in the database. 

32. A computer program product for managing changes in a computer system, comprising a 
computer program encoded on a computer-readable media and executable on a computer 
to: 

select processes on the computer system in accordance with input specifications, 
detect changes made by the selected processes to data items, and 
store the detected changes as change records in a database. 

33. The computer program product of claim 32 wherein said computer program limits 
the detection of changes to only data items matching specified criteria. 

34. The computer program product of claim 32 wherein said computer program selects 
change records from the database pursuant to specified critieria. 
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35. The computer program product of claim 34 wherein said computer program 
provides the selected change records in a specified output format. 

36. The computer program product of claim 34 wherein said computer program: 
determines the reverse of the changes stored in the selected change records, and 
applies the reverse of the selected change records to the data items referred to by 
the selected change records in order to return the data items to their state prior 
to the occurrence of the selected change records. 

37. The computer program product of claim 35 wherein said computer program 
applies the selected change records to similar data items on a different computer 
system to cause the same changes on the different computer system. 

38. The computer program product of claim 32 wherein said computer program stores 
the reverse of the detected changes as change records in the database. 

39. The computer program product of claim 38 wherein said computer program: , 
selects specified change records from the database pursuant to specified • 
criteria, 

applies the reverse of the selected change records to the data items referred 
to by the selected change records in order to return the data items to their 
state prior to the occurrence of the selected change records. 

40. The computer program product of claim 32 wherein said computer program: 
condenses sequences of change records to eliminate intermediate changes, and 
stores the condensed sequences in the database. 

41 . The computer program product of claim 32 wherein said computer program adds a 
user-specified field to a change record in the database. 

42. The computer program product of claim 32 wherein said computer program 
terminates the detection of changes upon the occurrence of any of (i) user request, (ii) 
the satisfaction of conditions specified by the user, or (iii) termination of all selected 
processes. 

43. The computer program product of claim 32, wherein said computer program detects 
links from a data item to other data items. 
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45. The computer program product of claim 32, wherein said computer program detects 
changes made by one or more of the selected processes to a first data item resulting 
from changes to a second data item linked to the first data item. 

46. The computer program product of claim 32 wherein said computer program alerts a 
user when changes matching specified criteria are detected. 

47. The computer program product of claim 32 wherein said computer program 
transmits information about the detected changes to a specified destination. 

48. The computer program product of claim 32 wherein said computer program 

detects changes to data items on a remote computer system by selected 
processes on the computer system prior to storing the changes in the database, 
records the identity of the remote computer system in the database, and 
associates the identity of the remote computer system with the change in the 
stored change record. 

49. The computer program product of claim 32 wherein said computer program detects 
communication attempts by the selected processes. 

50. The computer program product of claim 49 wherein said computer program 

determines any processes that are the destination of the communication 
attempts, 

detects changes made by the destination processes to data items, and 
stores the detected changes as change records in the database. 

51 . The computer program product of claim 49 wherein said computer program 

detects that the communication attempts are to processes on a remote 
computer system, 

determines any processes on the remote computer system that are the 
destination of the communication attempts, 

detects changes made by the destination processes to data items, and 
stores the detected changes as change records in the database. 

52. The computer program product of claim 32 wherein said computer program 
records specified changes in a session history, and 
stores the session history as a session record in the database. 



53. The computer program product of claim 52 wherein said computer program: 
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searches the database for any session records matching specified criteria, 
selects change records referred to by the matching session records, and 
produces the selected change records in a specified output format. 

54. The computer program product of claim 52 wherein said computer program: 

condenses sequences of changes in the session history to eliminate 
intermediate changes, and 

stores the condensed session history as a session in the database. 

55. The computer program product of claim 52 wherein said computer program adds 
a user-specified field to the session history. 

56. The computer program product of claim 52 wherein said computer program adds 
additional processes to an existing session history. 

57. The computer program product of claim 52 wherein said computer program 
terminates the session history upon the occurrence of any of (i) user request, (ii) the 
satisfaction of conditions specified by the user, or (iii) termination of all selected 
processes. 

58. The computer program product of claim 52 wherein said computer program 
alerts a user when a session history matching specified criteria is detected. 

59. The computer program product of claim 52 wherein said computer program 
transmits information about the session history to a specified destination. 

60. The computer program product of claim 52 wherein said computer program 

detects changes in the session history to data items on a remote compuler 
system prior to storing the session record in the database, 
records the identity of the remote computer system in the database, and 
associates the identity of the remote computer system with the session record 
in the searchable database, 

61 . The computer program product of claim 52 wherein said computer program 
detects communication attempts by the selected processes. 

62. The computer program product of claim 61 wherein said computer program 
determines any processes that are the destination of the communication 
attempts, 
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detects changes made by the destination processes to data items, 

records the detected changes in a session history, and 

stores the session history as a session in the searchable database. 

63. The computer program product of claim 61 wherein said computer program 
detects that the communication attempts are to processes on a remote 
computer system, 

determines any processes on the remote computer system that are the 

destination of the communication attempts, 

detects changes made by the destination processes to data items, 

records the detected changes in a session history, and 

stores the session history as a session in the searchable database. 

64. A data structure for facilitating management of changes in a computer system, 
comprising a database stored on a computer-readable media, the database having a plurality. 
of change records, wherein each change record corresponds to a change to a data item by a 
process, comprising information that refers to the identity of data item changed, the process 
or processes effecting the change, and the nature of the change. 

65. The data structure of claim 64 in which the change record further comprises 
information referring to the user initiating a change. 

66. The data structure of claim 64 in which the change record further comprises 
descriptive or identifying information about the change. 

67. The data structure of claim 64 in which the database further comprises link 
records, wherein each link record comprises information that refers to a relationship 
between data items. 

68. The data structure of claim 64 in which the database further comprises session 
records, wherein each session record comprises information that refers to a plurality 
of changes in a session history. 

69. The data structure of claim 68 in which the session record further 
comprises information referring to the user initiating the session history. 

70. The data structure of claim 68 in which the session record further 
comprises descriptive or identifying information about the session history. 
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71 . The data structure of claim 68 in which the session record further 
comprises information generated during the session history whereby the 
session record contains a count of any of (i) the number of changes detected 
(ii) the number of processes selected (iii) the number of linked data items 
changed (iv) the number of remote change sessions initiated. 

72. The data structure of claim 68 in which the session record further 
comprises information with the identity of remote computer systems that 
were affected by changes in the session history referred to by the session 
record. 



73. The data structure of claim 72 in which the session record further 
comprises information referring to remote session records on remote 
computer systems that were affected by changes in the session history 
referred to by the session record. 

74. A computer program product for managing changes in a computer system, comprising a . 
computer program encoded on a computer-readable media and executable on a computer 
to: 

perform searches in a database containing historical information of changes made by 
processes within the computer system to data items or links to data items, and 
produce the results of said searches in a specified output format. 

75. The computer program product of claim 74 wherein a plurality of changes in the 
database are recorded in sessions which are stored as session records in the 
database. 



76. The computer program product of claim 75 wherein remote computer 
systems are associated with session records in the database. 



